spring Security4 和 oauth2整合替換6位的授權碼

git地址：https://gitee.com/xiaoyaofeiyang/OauthUmp

spring Security4 和 oauth2整合 註解+xml混合使用（基礎執行篇）
spring Security4 和 oauth2整合 註解+xml混合使用（進階篇）
spring Security4 和 oauth2整合 註解+xml混合使用（授權碼篇）
spring Security4 和 oauth2整合 註解+xml混合使用（注意事項篇）
spring Security4 和 oauth2整合 註解+xml混合使用（替換6位的授權碼）

InMemoryAuthorizationCodeServices

InMemoryAuthorizationCodeServices是spring oauth2生成授權碼code的bean，這個是new出來的，所以我們不能通過自定義bean去替換，預設是生成6位的code。但是還是可以替換的。

自定義InMemoryAuthorizationCodeServices

生成16位code，這裡我是通過xml配置了bean，方便替換，也可以用@Component，我這裡沒去試。

<bean id="authorizationCodeServices"
        class="com.ump.oauth.part.InMemoryAuthorizationCodeServices">
    </bean>

package com.ump.oauth.part;

import java.util.concurrent.ConcurrentHashMap;

import org.springframework.security.oauth2.common.util.RandomValueStringGenerator;
import
 
 org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.code.RandomValueAuthorizationCodeServices;

public class InMemoryAuthorizationCodeServices extends RandomValueAuthorizationCodeServices{
    protected final ConcurrentHashMap<String, OAuth2Authentication> authorizationCodeStore = new ConcurrentHashMap<String, OAuth2Authentication>();
    private RandomValueStringGenerator generator = new RandomValueStringGenerator(16);
    @Override
    protected void store(String code, OAuth2Authentication authentication) {
        this.authorizationCodeStore.put(code, authentication);
    }

    @Override
    public OAuth2Authentication remove(String code) {
        OAuth2Authentication auth = this.authorizationCodeStore.remove(code);
        return auth;
    }

    @Override
    public String createAuthorizationCode(OAuth2Authentication authentication) {
        String code = generator.generate();
        store(code, authentication);
        return code;
    }
}

認證配置

AuthorizationServerConfiguration中配置AuthorizationServerEndpointsConfigurer有設定authorizationCodeServices的方法。就是一個autowired和endpoints.authorizationCodeServices(authorizationCodeServices);即可。

package com.ump.oauth.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.ClientDetailsService;
import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
import org.springframework.security.oauth2.provider.code.AuthorizationCodeServices;
import org.springframework.security.oauth2.provider.token.TokenStore;

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

    private static String REALM = "MY_OAUTH_REALM";

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    @Qualifier("myClientDetailsService") 
    private ClientDetailsService clientDetailsService;

    @Autowired
    private UserApprovalHandler userApprovalHandler;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Autowired
    @Qualifier("authorizationCodeServices")
    private AuthorizationCodeServices authorizationCodeServices;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.withClientDetails(clientDetailsService);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
                .authenticationManager(authenticationManager);
        endpoints.authorizationCodeServices(authorizationCodeServices);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.allowFormAuthenticationForClients();
        oauthServer.realm(REALM + "/client");
    }
}